From: Specializing network analysis to detect anomalous insider actions
Variable | Description |
---|---|
S = {s1, s2, . . . , s m } | The set of subjects in the CIS. |
U = {u1, u2, . . . , u n } | The set of users in the CIS. |
u j → s i | An access of user u j to subject s i . |
| The set of users that access subject s i . |
| A complete graph of . |
SU | A binary matrix of subjects and users, the size of which is m × n. If u i accesses s j , SU(j, i) = 1, else SU(j, i) = 0. |
U i | A column vector of access history of u i on all subjects. U i = SU[:, i]. |
SU_IDF | A matrix with the same size as SU. Each cell value of SU_IDF corresponds to its inverse document frequency (IDF) transformation. |
B = [1, 1, . . . , 1] | A vector of 1's of length m. |
IDF_U i | A column vector of access history of u i on all subjects. IDF_U i = SU_IDF[:, i]. |
PC' | A matrix created from SU or SU_IDF, the size of which is l × n, where l is the number of selected principal components. |
λ k | The kth eigenvalue |
λ total | The sum of the l eigenvalues. |
λPC' | A matrix created from PC', where λPC'[k, :] = (λ k /λ total ) × PC'[k, :]. |
C i | A column vector of u i on the selected l principal components. C i = λPC'[:, i]. |